Sticky problem

Question

Hi, we have an issue where the sticky tables on our CSS are too large, so that if a server fails, connections move to the rest of the farm. As the sticky table does not time out anytime soon the failed server does not get many connections when it is back online.
Sticky-inact-timer command does not work as this only makes the entries eligible for removal.
The content rule is a L4 on port 443, I tried to configure this as an L5 rule with arrowpoint cookies but I suspect this does not work as we are using SSL connection that is not terminated on the CSS.
The servers themselves send a cookie ? Can I make use of this or as the connection is port 443 am I stuck ?
Any other solutions would be much appreciated.
cheers,
Mike

Answer 1

Mike,
let me first say, that if you configure a sticky-inact-timeout, once the entry times out it is removed IMMEDIATELY. There is no concept of elligibility. [this for flows and garbage collection - nothing to do with stickyness].
Here is an example
CSS11503-2(debug)# show sticky-table l3-sticky
L3 Sticky List on Slot 1, subslot 1:
Entries for page 1.
Entry Hash Rule Rule Srv Srv Time(Sec) Hit Col Elem Inact
Number Value Indx State Indx State Elapsed Cnt Cnt Type Cfg(Min)
1 c0a81429 5 ACT 9 EGRES 59 2 0 L3 1
Total number of entries found is 1.
L3 Sticky List on Slot 3, subslot 1:
Entries for page 1.
Entry Hash Rule Rule Srv Srv Time(Sec) Hit Col Elem Inact
Number Value Indx State Indx State Elapsed Cnt Cnt Type Cfg(Min)
Total number of entries found is 0.
CSS11503-2(debug)# show sticky-table l3-sticky
L3 Sticky List on Slot 1, subslot 1:
Entries for page 1.
Entry Hash Rule Rule Srv Srv Time(Sec) Hit Col Elem Inact
Number Value Indx State Indx State Elapsed Cnt Cnt Type Cfg(Min)
Total number of entries found is 0.
L3 Sticky List on Slot 3, subslot 1:
Entries for page 1.
Entry Hash Rule Rule Srv Srv Time(Sec) Hit Col Elem Inact
Number Value Indx State Indx State Elapsed Cnt Cnt Type Cfg(Min)
Total number of entries found is 0.
CSS11503-2(debug)# show sticky-table l3-sticky
L3 Sticky List on Slot 1, subslot 1:
Entries for page 1.
Entry Hash Rule Rule Srv Srv Time(Sec) Hit Col Elem Inact
Number Value Indx State Indx State Elapsed Cnt Cnt Type Cfg(Min)
1 c0a81429 5 ACT 14 EGRES 3 1 0 L3 1
As you can see, with a 1 min timeout, after 60 sec the entry is removed, and the next time the client comes in it is sent to a different server which creates a new entry.
So, your problem is that you either do not have the sticky-inact-timeout, in which case you need to manually clear the sticky table when a server goes down/up, or you have the timeout configured but with a value too high so the sticky entry is never removed because always refreshed by a new connection.
You can use 'advanced-balance ssl' without the ssl module but it only works with 1 type of ssl protocol - SSLv2 [I think] and for the other protocols it just reverts back to sticky-srcip.
So, you should stick with sticky-srcip and just make it works correctly by setting correct parameter or by clearing the sticky table manually.
Finally, I'd like to say that there is a known-issue with sticky-srcip in general.
This is the use of mega-proxy on the Internet.
A lot of people sitting behind a proxy and therefore appearing with a single ip address on the internet.
This is known to cause un-even loadbalancing.
That might be your problem and changing the inact-timeout would have no effect.
This is one of the reason for a lot of people to buy the ssl module so they can use cookies.
Gilles.